The next example illustrates the use of the break-rewrite facility
to get information about handling of free variables by the rewriter.
Explanation is given after this (edited) transcript. Input begins on lines
with a prompt (search for ``ACL2''); the rest is output.

The :eval command above asks the rewriter to attempt to apply the rewrite
rule lemma-1 to the term (prop u0), shown just above the line with
:eval. As we can see at the end, the variable u in the conclusion of
lemma-1 is being bound to the variable u0 in the conjecture. The
first hypothesis of lemma-1 is (p1 u x), so the rewriter looks for
some x for which (p1 u0 x) is known to be true. It finds x1, and
then goes on to consider the second hypothesis, (bad x). Since the
theorem we are proving has (bad x1) in the hypothesis and x is
currently bound to x1, the rewriter is satisfied and moves on to the
third hypothesis of lemma-1, (p2 x y z). However, x is bound
to x1 and there are no instances of y and z for which
(p2 x1 y z) is known in the current context. All of the above analysis
is summarized in the first part of the output from :eval above:

Thus, the binding of x to x1 on behalf of the first hypothesis has
failed.

The rewriter now backs up to look for other values of x that satisfy the
first hypothesis, and finds x2 because our current theorem has a
hypothesis of (p1 u0 x2). But this time, the second hypothesis of
lemma-1, (bad x), is not known to be true for x; that is,
(bad x2) does not rewrite to t; in fact, it rewrites to itself. That
explains the next part of the output from :eval above:

[1] X : X2
Failed because :HYP 2 rewrote to (BAD X2).

The rewriter now backs up again to look for other values of x that
satisfy the first hypothesis, and finds x3 because our current theorem
has a hypothesis of (p1 u0 x3). This time, the second hypothesis of
lemma-1 is not a problem, and moreover, the rewriter is able to bind
y and z to y1 and z1, respectively, in order to satisfy the
third hypothesis, (p2 x y z): that is, (p2 x2 y1 z1) is known in the
current context. That explains more of the above output from :eval:

The next pair of examples illustrates so-called ``binding hypotheses''
(see free-variables) and explores some of their subtleties. The first shows
binding hypotheses in action on a simple example. The second shows how
binding hypotheses interact with equivalence relations and explains the role
of double-rewrite.

Our first example sets up a theory with two user-supplied rewrite rules, one
of which has a binding hypothesis. Below we explain how that binding
hypothesis contributes to the proof.

Let us look at how ACL2 uses the above binding hypothesis in the proof of the
preceding thm form. The rewriter considers the term (g (h a)) and
finds a match with the left-hand side of the rule g-rewrite, binding
x to (h a). The first hypothesis binds y to the result of
rewriting (k x) in the current context, where the variable x is bound
to the term (h a); thus y is bound to (k (h a)). The second
hypothesis, (f y), is then rewritten under this binding, and the result
is t by application of the rewrite rule f-k-h. The rule
g-rewrite is then applied under the already-mentioned binding of x to
(h a). This rule application triggers a recursive rewrite of the
right-hand side of g-rewrite, which is y, in a context where y is
bound (as discussed above) to (k (h a)). The result of this rewrite is
that same term, (k (h a)). The original call of equal then trivially
rewrites to t.

We move on now to our second example, which is similar but involves a
user-defined equivalence relation. You may find it helpful to review
:equivalence rules; see equivalence.

Recall that when a hypothesis is a call of an equivalence relation other than
equal, the second argument must be a call of double-rewrite in
order for the hypothesis to be treated as a binding hypothesis. That is
indeed the case below; an explanation follows.

The proof succeeds much as in the first example, but the following
observation is key: when ACL2 binds y upon considering the first
hypothesis of lemma-3, it rewrites the term (double-rewrite x) in a
context where it need only preserve the equivalence relation my-equiv.
At this point, x is bound by applying lemma-3 to the term
(g (h1 a)); so, x is bound to (h1 a). The rule lemma-1 then
applies to rewrite this occurrence of x to (h2 a), but only because
it suffices to preserve my-equiv. Thus y is ultimately bound to
(h2 a), and the proof succeeds as one would expect.

If we tweak the above example slightly by disabling the user's
equivalencerune, then the proof of the thm form fails
because the above rewrite of (double-rewrite x) is done in a context
where it no longer suffices to preserve my-equiv as we dive into the
second argument of my-equiv in the first hypothesis of lemma-3; so,
lemma-1 does not apply this time.